Glossary

Refresh Token

In OAuth, a long-lived token used to obtain new short-lived access tokens without prompting the user again. Refresh tokens carry significant power and must be stored and rotated carefully.

Regional Regulations

Cloud-relevant regulations specific to a country, state, or region (such as GDPR in the EU or state privacy laws in the US) that organizations must comply with where they operate or serve users.

Registry Run Key Detection

Detecting persistence via Windows registry run keys, common autostart locations attackers abuse, by monitoring changes to those keys and writing detections (often mapped to ATT&CK) for suspicious entries.

Regression Testing

In detection engineering, retesting detections after changes to ensure they still work and don't break expected behavior, so improvements don't silently degrade coverage of existing threats.

Regulations

Mandatory rules imposed by governments or regulators on how organizations must protect information, secure systems, and handle incidents. Regulations are foundational drivers of security and privacy programs.

Regulatory Notification

The legally required notification of regulators (and sometimes affected individuals) after qualifying incidents, with timelines, content, and channels that vary by jurisdiction and regulation.

Regulatory Notification Timing

The leadership-level challenge of meeting strict regulatory notification deadlines (such as GDPR's 72 hours) during an incident, balancing speed, accuracy, and legal risk under pressure.

Regulatory vs Voluntary

The distinction between mandatory regulatory requirements and voluntary frameworks an organization adopts, that shapes priorities, enforcement, and how the organization frames compliance versus best-practice work.

Remediation

Fixing or reducing a weakness so it no longer creates the same level of risk.

Remediation Ownership

Assigning clear ownership for remediating each vulnerability or finding to a specific team or person, so issues don't languish without anyone responsible to fix them, foundational to effective vulnerability management.

Remediation Planning

Planning how to address audit findings, scoping the fix, assigning ownership, setting timelines, and aligning resources, so remediation is intentional and trackable rather than ad hoc.

Remediation Tracking

Tracking audit findings through to completion, status, timelines, owner action, evidence of fix, so issues are visibly resolved and recurring problems are surfaced rather than quietly persisting.

Remediation Verification

Confirming that a vulnerability or finding has actually been fixed, by retesting or re-scanning, so issues aren't closed in trackers while still exploitable in reality.

Remote Services

Internet-reachable services that enable remote access (SSH, RDP, VPN, remote-management interfaces). Attackers target them heavily for initial access and lateral movement, so they require special hardening.

Removable Media

USB drives, external disks, and similar portable devices, a notable attack vector for delivering malware, exfiltrating data, or bypassing network controls, requiring deliberate policy and technical controls.

Report Finding Prioritization

Ranking assessment findings by risk and impact so the most important issues stand out in the report, helping the client know where to focus remediation effort first.

Reporting Channels

The defined ways employees can report security concerns, suspicious emails, near misses, or incidents, hotlines, mailboxes, ticketing, that make reporting easy, trusted, and timely.

Requirements Definition Process

The disciplined process of defining what an intelligence program must answer, eliciting needs from stakeholders, translating them into clear intelligence requirements, and prioritizing across consumers.

Requirements Evolution

Updating intelligence requirements over time as the threat landscape, business, and stakeholder needs change, so the program continues to answer the right questions rather than the questions it started with.

Requirements Validation

Checking that intelligence requirements are clear, prioritized, and actually being answered, so the program can correct drift and demonstrate it is delivering value against the questions consumers care about.

Residual Risk

The risk that remains after controls are applied.

Resolver

A DNS component that takes a domain query and finds the answer, recursively asking authoritative servers if needed. Resolvers are a foundational piece of DNS and a key place to monitor for malicious activity.

Resource-Based Policies

Cloud access policies attached directly to a resource (like a bucket or queue) that say who may access it, complementing identity-based policies that say what an identity may do.

Response

An HTTP message returned by a server to a client, carrying a status, headers, and content. Defenders read responses to understand application behavior and to spot leakage or anomalies in server replies.

Response Automation

Automating cloud-workload response actions, isolating an instance, revoking credentials, blocking IPs, so detection-to-action time shrinks dramatically, especially valuable in dynamic cloud environments.

Response Tempo

The pace at which an organization handles an ongoing incident, decisions, communications, technical actions, that must be set and sustained deliberately rather than left to circumstance.

Review Cycle Management

Managing how policies move through their scheduled review cycles, who reviews, when, what changes, and how outcomes are documented, so reviews actually happen and produce updates rather than slip.

Revocation

Invalidating a certificate, key, or token before its natural expiry, used when it has been compromised, no longer trusted, or its purpose has ended. Revocation is foundational to PKI's trust model.

Risk

Risk is the possibility that a threat could exploit a weakness and cause harm to something valuable.

Risk Acceptance

A decision to acknowledge and tolerate a risk rather than reduce or transfer it immediately.

Risk Aggregation

Combining individual risks into a portfolio-level view so leadership sees overall exposure, not just isolated risks, supported well by quantitative methods and harder with purely qualitative ones.